EC2 Audit
Checks performed
- EC2 Instance Snapshots Should Not Be Public
- Long Running Instances Should Be Re-launched
- EC2 AMIs Should Not Be Public
- EC2 AMIs Should Be Encrypted
- EC2 Instances Should Not Reach vCPU Limit
- Blacklisted AMIs Should Not Be Used
- Default VPC Should Not Be In Use
- Security Groups Should Have Descriptions
- AMI Age Should Not Exceed the Configured Age
- EC2 Instance Should Be of Desired Type
- Detailed Monitoring for EC2 Instances Should Be Enabled
- EC2 Classic Should Not Be Used
- Scheduled Events for EC2 Instances
- EC2 Instances With Multiple Security Groups
- Termination Protection Should Be Enabled
- Unrestricted Netbios Access Should Not Be Allowed
- Unrestricted Outbound Access Should Not Be Allowed
- EC2 IAM Roles Should Be Used
- Restrict data-tier subnet connectivity to VPC NAT Gateway
- Unrestricted CIFS Access Should Not Be Allowed
- Unrestricted ICMP Access Should Not Be Allowed
- Unrestricted Inbound Access on All Uncommon Ports Should Not Be Allowed
- Unrestricted MongoDB Access Should Not Be Allowed
- Unrestricted MsSQL Access Should Not Be Allowed
- Unrestricted MySQL Access Should Not Be Allowed
- Unrestricted Oracle Access Should Not Be Allowed
- Security Group Port Range
- Unrestricted PostgreSQL Access Should Not Be Allowed
- Unrestricted RDP Access Should Not Be Allowed
- Unrestricted RPC Access Should Not Be Allowed
- Unrestricted SMTP Access Should Not Be Allowed
- Default Security Group Should Not Allow Unrestricted Public Traffic
- Unrestricted Telnet Access Should Not Be Allowed
- Unrestricted SSH Access Should Not Be Allowed
- Unrestricted Elasticsearch Access Should Not Be Allowed
- Unrestricted FTP Access Should Not Be Allowed
- EC2 Reserved Instances Should Not Have Payment Failed
- EC2 Reserved Instances Should Not Have Payment Pending
- EC2 Reserved Instances Recent Purchases Should Be Reviewed
- EC2-Classic Elastic IP Address Limit Should Not Be Reached
- EC2-VPC Elastic IP Address Limit Should Not Be Reached
- AWS EC2 Hibernation Should Be Enabled
- Instance Should Be Launched In Auto Scaling Group
- Reserved Instance Lease Expiration In The Next 30 Days
- Reserved Instance Lease Expiration In The Next 7 Days
- Security Group Excessive Counts
- Security Group Name Prefixed With launch-wizard Should Not Be Used
- EC2 Instance Count Should Not Exceed the Limit
- EC2 Instances Should Use Latest Generation
- Security Group Rules Counts
- Security Groups Should Not Allow Inbound Traffic From RFC 1918
- Unassociated Elastic IP Addresses Should Be Removed
- EC2 Instance Should Not Be In Public Subnet
- Unrestricted DNS Access Should Not Be Allowed
- Unrestricted HTTP Access Should Not Be Allowed
- Unrestricted HTTPS Access Should Not Be Allowed
- EC2 Instances Should Not Have Blacklisted Instance Types
- Unused Elastic Network Interfaces Should Be Removed
- Unused AMIs Should Be Removed
- Unused AWS EC2 Key Pairs Should Be Removed
- Reserved Instances Should Not Be Unused
- EC2 Instances Should Not Be Overutilized
- EC2 Instances Should Not Be Idle
- EC2 Instances Should Not Be Underutilized
- EC2 Instance Tenancy